Many first-time ISO 27001 projects start by downloading a pack of security policies. That is the wrong way round. The standard is risk-based: your controls should come from your risk assessment, not the other way round.
Step 1: Define your method
Before assessing anything, decide and document:
- How you will identify risks (for example asset-based or scenario-based)
- How you will rate likelihood and impact (a simple 1 to 5 scale works well)
- Your risk acceptance criteria: which risk levels are acceptable without further action
The method must produce consistent, comparable results if repeated.
Step 2: Identify risks
A practical approach is to list your information assets and processes, then ask what could affect their:
- Confidentiality: who could see information they shouldn't?
- Integrity: how could information be altered or corrupted?
- Availability: what could stop people accessing information when needed?
Think about threats (such as phishing, ransomware, lost laptops, staff error, supplier failure) and the vulnerabilities that allow them.
Step 3: Analyse and evaluate
Rate each risk for likelihood and impact, calculate the risk level, and compare it to your acceptance criteria. Assign a risk owner to each risk.
Step 4: Treat the risks
For each risk above your acceptance level, choose to reduce, avoid, transfer or accept it. Select controls from Annex A of ISO 27001 (93 controls in the 2022 edition) or elsewhere.
Step 5: Statement of Applicability
The Statement of Applicability lists every Annex A control, whether it is applicable, whether it is implemented, and why. It links your risk treatment to the controls you use.
Keep it current
Repeat the assessment at planned intervals and whenever significant changes happen, such as new systems, suppliers or ways of working. A living risk register is what makes an ISMS genuinely useful.